fyi... just cause you get a 404 error doesn't mean the site is down, it might mean you are blocked. IIS for example has the request filtering module inwhich you can return a status code when a certain filter is hit. it is very easy to create a filter where is a query parameter is over a certain character limit to return a 404 (filters are just regular expression). this is why you should always check a site from https://downforeveryoneorjustme.com/downforme.com
Stopping phishing campaigns with Bash
141–150 of 169 posts
Re: Stopping phishing campaigns with Bash
#142I stoped 2 webshops which basically sell expensive stuff 20% off by wire transfer (bank transfer?!) which then never send the goods of course! I did the following: - I found out where it was hosted and send them an email explaining them why and how that shop is a scam - I found out where they hosted the domain and wrote the registrar an abuse email - I wrote an email to the banks where the bank accounts where active…
Abuse email/report to the registrar is also my goto. Usually results in a quick response
You'll get a response but it'll always be a polite "fuck off" unless you have some sort of actual authority (are you the trademark holder? are you LE? do you have a court order?). You'll have better luck contacting the hosting provider because they're actually responsible for the content.
Re: Stopping phishing campaigns with Bash
#143I know someone that DDoSed a forum spammer. They hit back, ten times as hard, and completely destroyed a well-established forum, with thousands of users, that had experienced an annoying (but not crippling) "penis pill" spam attack.
So like... Backups? Restore, put it behind basic auth and email the password to the members active in the past few weeks, then at your leasure implement some captchas and go from there. Heck, restore the forum publicly as well and use that as a sandbox to see how they'll bypass it.
He said DDoS which has nothing to do with the data itself, and auth/captcha won't help. You'll have to upgrade to beefier servers, fatter pipes, or pay for a reverse proxy.. CF is free now and kinda helps sometimes, but it wasn't in the past, and any hacker with a grudge can take down your site anyway. It's about forcing you to spend money; which, if you're a hobby site forum host, you probably don't have.
Re: Stopping phishing campaigns with Bash
#144So you DDOSed their backend but they could've whitelist their IP range and blacklist all the others for incoming requests. What you did does nothing against flexible and adaptive adversaries.
Even if that's the case, it made the website unavailable for future victims who got the same text messages.
Not if they just made the site return a 404/500 just to his IPs, which any half-decent adversary would do. The "play dead" strategy works great with these kind of vigilantes.
We're employed similar tactics against DDoSers at work. Start returning 500s or just tarpit their requests, they think the site is down and they go home.
Re: Stopping phishing campaigns with Bash
#145I have made something similar couple of years ago, but I took down the video that I recorded doing it cause I was afraid it could turn back on me.
These days I usually try to write an email to the abusar and to the hosting services. I also did a bunch of this "flags" on Instagram ads.
Instagram is the worst, cause they open a website in their app, hiding the true URL of the phishing site. I sent a complain to them about that. Never heard back.
Re: Stopping phishing campaigns with Bash
#146Re: Stopping phishing campaigns with Bash
#147That's really... not an appropriate response, and not only for the legal reasons others mentioned. Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Plus, you didn't solve anything, from the pattern you used it's pretty easy to cleanup…
> A more appropriate response is to report the abuse who manages the infrastructure (most likely a legitimate provider) and the domain registar; both usually have appropriate channels and response procedures just for that. Unless of course it's behind Cloudflare - then you cannot find out whose infrastructure the criminals are operating from and Cloudflare itself does not give a fuck. Best case scenario: they will fo…
Pardon me but I've contacted multiple times Cloudflare and they always shut them down.
Re: Stopping phishing campaigns with Bash
#148Earlier quoted context omitted.
> A more appropriate response is to report the abuse who manages the infrastructure (most likely a legitimate provider) and the domain registar; both usually have appropriate channels and response procedures just for that. Unless of course it's behind Cloudflare - then you cannot find out whose infrastructure the criminals are operating from and Cloudflare itself does not give a fuck. Best case scenario: they will fo…
They claim they will do all this for you if they are (allegedly) proxying malicious content. Source: their abuse form [1], selecting "Phishing & Malware". Did you have bad experiences with this? Might be worth sharing. [1] https://www.cloudflare.com/abuse/form
I had recently a (b/s)ad experience with them. I am hosting the demo site for my open source image hosting solution (pictshare) behind cloudflare and had the CASM tool (that searches automatically for child pornography) enabled. Felt safe enough but after a while I noticed a TON of traffic.. like gigabytes an hour through cloudflare
Turned out someone uploaded like 1000 child pornography images to the demo site, cloudflare didn't once send me anything or block an image before being uploaded.
I wrote their support and they pointed me to the abuse form you mentioned (which would had reported the content to myself?)
I thought they'd look into their logs and send interpol the uploaders IP addresses but no, they didn't do anything.
In the end I got interpol and the local BKA (Federal Criminal Police Office) and they were so awesome and I prepared excel sheets for them with all ip addresses and log entries of every consumer and uploader.
Re: Stopping phishing campaigns with Bash
#149> cat /dev/urandom | tr -dc '0-9' | fold -w 7 | head -n 1
Useless use of cat
Re: Stopping phishing campaigns with Bash
#150That's really... not an appropriate response, and not only for the legal reasons others mentioned. Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Plus, you didn't solve anything, from the pattern you used it's pretty easy to cleanup…
I had a similar situation happen to me. Someone was catfishing (dogfishing?) using my dog; they have him listed for sale...
I phished the seller into giving me their Zelle email which was a full name and presumably tied to a legit bank account with a legit person associated with it.
I reported them, will all the facts I'd collected to the AG office in the state I believed them to be in (OH- b/c they offered shipping to anywhere + local delivery in Cleveland). I reached out to other dog owners that I could identify and urged them to also file reports.
I passed along this information to a friend who works in cyber crimes law enforcement (specifically in crimes against children). He verified the information I provided to the best of his ability and passed to his peers in another agency.
Months later, nothing except an automated thanks from the AG office and the site is still up.
The main issue I'm told is I don't have any victims who actually tried to purchase and never receive a puppy.
https://www.qualitygreatdanepuppies.com/available-puppies
"Johnny" is my dog. That photo is in front of my old apartment.
I do not condone this approach of striking back, but I am frustrated that even when I identify the culprit of a scam, theres nothing I can do.